Cross-chain protocol Chainflip disclosed an attack involving Tron USDT and said 736,442.17 USDT was stolen through six unauthorized payouts. The project also said 115,654.41 USDT tied to user swaps remains in the vault after payout failures, while all other funds were unaffected. According to Chainflip, the attacker abused a flaw related to Tron transaction memos by attaching custom memos to validator-signed transactions, causing the system to treat the same deposit as a separate swap and issue another refund. Chainflip said the attacker carried out eight operations over roughly 90 minutes and increased the amounts over time. The team said a fix has been completed, the stolen funds have been flagged with relevant institutions in an attempt to recover them, and operations are expected to resume as early as Monday. Chainflip also said it will cover losses suffered by affected users.
Chainflip said an attack targeting Tron USDT took place yesterday, with 736,442.17 USDT confirmed stolen through six unauthorized payouts.
The protocol added that 115,654.41 USDT tied to user swaps remains in the vault because those payouts failed. All other funds were not affected, according to the project.
How the attack worked
Chainflip said the attacker exploited a flaw tied to Tron transaction memos. By attaching a custom memo to transactions that validators had already signed, the attacker caused the system to recognize the same deposit as a separate swap and issue another refund, which led to repeated payouts.
The team said the attacker performed eight operations over about 90 minutes and gradually increased the amount involved. Chainflip said it has completed a fix, and that the stolen funds have been flagged with relevant institutions in an effort to recover them.
The protocol said service is expected to resume as early as Monday. It also said it will make affected users whole for their losses.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
